Export limit exceeded: 376157 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376157 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-80573 | 1 Linux | 1 Linux Kernel | 2026-08-27 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. The status tail is a sequence of 16-bit effect addresses, but an incomplete final address is also consumed. A successful zero-length USB URB additionally reads the packet ID before the common parser is called. Reject the zero-length USB transfer, require the seven-byte joystick and wheel prefixes and the two-byte status prefix, and consume only complete status-tail addresses. | ||||
| CVE-2026-80538 | 1 Linux | 1 Linux Kernel | 2026-08-27 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfs_rtginode_load xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs then continues as though the inode had been loaded. Only -ENOENT means that the inode needs to be created. Return all other errors to the growfs caller. | ||||
| CVE-2026-80537 | 1 Linux | 1 Linux Kernel | 2026-08-27 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfs_rtrefcountbt_compute_maxlevels() sets mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1; where the trailing "+ 1" already accounts for the inode-root level, so the deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must satisfy bc_nlevels <= bc_maxlevels (= m_rtrefc_maxlevels). The two on-disk validation paths, xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount(), check the root level with ">" instead of ">=", so a crafted rtreflink (metadir + realtime + reflink) image whose /rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1, exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, the first btree op on such a cursor indexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is reached by the first rtrefcount cursor built after mount, via log/CoW recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an FS_IOC_GETFSMAP over the realtime device. Reject a root level equal to m_rtrefc_maxlevels, matching the ">=" form already used by the sibling data-device refcount/rmap verifiers and the in-memory rtrmap verifier. BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101) Write of size 2 at addr ffff888018391658 by task exploit/144 xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101) xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308) xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113) xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085) xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551) xfs_mountfs (fs/xfs/xfs_mount.c:1158) xfs_fs_fill_super (fs/xfs/xfs_super.c:1940) get_tree_bdev_flags (fs/super.c:1634) vfs_get_tree (fs/super.c:1694) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216 The buggy address is located 8 bytes to the right of allocated 216-byte region [ffff888018391578, ffff888018391650) Kernel panic - not syncing: Fatal exception | ||||
| CVE-2026-80530 | 1 Linux | 1 Linux Kernel | 2026-08-27 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file that currently has it to the other file, as long as exactly one side is marked. This assumes that the file contents, and therefore all shared extents, are exchanged. That assumption is not true when XFS_EXCHMAPS_INO1_WRITTEN is set. xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings from file1, so an exchange can complete without moving every mapping that the earlier flag-swap decision accounted for. In that case the post-operation cleanup can clear the reflink flag from an inode that still owns shared written extents. Later writes then take the non-reflink write path and may update blocks that should still have been protected by CoW, which shows up as data corruption between reflink-related files. Fix this by disabling the reflink flag exchange whenever XFS_EXCHMAPS_INO1_WRITTEN is requested. The contents exchange can still proceed; the conservative outcome is that both inodes keep the reflink flag. The regular reflink flag cleanup path can drop the extra flag later once the inode no longer has shared extents. | ||||
| CVE-2023-22289 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22328 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22343 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22352 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22364 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22420 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22423 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22426 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22430 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22433 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22434 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22437 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22445 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-22446 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-23544 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||
| CVE-2023-27503 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||||